Notifications
Clear all
Topic starter
17/08/2026 4:37 pm
TL;DR: Developers are being asked to treat identity as code, unify visibility across humans, machines, and AI, and enforce just-in-time access as software systems and non-human identities proliferate, according to SailPoint. The governance challenge is no longer whether identity can be automated, but whether lifecycle, policy, and remediation can keep pace with runtime behaviour.
NHIMG editorial — based on content published by SailPoint: Shaping the future, how every developer can embrace adaptive identity
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams integrate identity controls into DevOps pipelines?
A: Start by moving identity checks to the earliest practical stage in delivery, such as pre-merge, build, or pre-deploy gates.
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Q: What do security teams get wrong about Shadow AI?
A: They often treat Shadow AI as an approval problem for software, when it is usually also an identity problem.
Practitioner guidance
- Embed identity policy into delivery pipelines Require access policy changes to move through source control, peer review, automated tests, and deployment gates before they reach production identity systems.
- Build a complete non-human identity inventory Track service accounts, API keys, tokens, certificates, bots, and AI-related identities across on-prem and multi-cloud environments, then classify each by owner, purpose, and expiry.
- Automate remediation for shadow AI and stale access Connect discovery signals to workflows that can disable, quarantine, or reissue access when unsanctioned AI activity or unowned non-human identities appear.
What's in the full article
SailPoint's full blog covers the operational detail this post intentionally leaves for the source:
- Developer-facing workflow examples for using SailPoint CLI and SDKs in identity-as-code pipelines
- Operational framing for SailPoint Agentic Fabric and how it connects identity context to broader security workflows
- Examples of Shadow AI Remediation in practice, including discovery and automated remediation paths
- Details from the SailPoint Developer Community, including API documentation, forums, and builder resources
👉 Read SailPoint's full blog on adaptive identity for developers and NHI governance →
Adaptive identity for developers: what changes for NHI governance?
Explore further
17/08/2026 4:43 pm
Identity-as-code is becoming the practical control surface for NHI governance. When access policy is defined in code, the real control is no longer the admin console but the delivery pipeline, version history, and review process. That shifts governance from periodic approval to continuous change control, which is where many IAM and IGA programmes still have weak coverage. Practitioners should treat code-defined identity as a first-class control plane, not a developer convenience.
A few things that frame the scale:
- From our research: 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do security teams know if just-in-time access is actually working?
A: Look for short-lived sessions, automatic revocation, and complete request-to-access logs. If approvals are still creating durable permissions, or if teardown depends on manual cleanup, then the programme is only partially ephemeral. Effective JIT should leave little or no reusable privilege behind after the task ends.
👉 Read our full editorial: Adaptive identity for developers is becoming an NHI control layer
